遠程call調用

typedef struct ParamData   //參數結構
{
    long Param1;
    long Param2;
    DWORD Param3; 
    DWORD Param4; 
}ParamData,*Paramp; 
 
//************************************************************************************** 
//函數名：InfusionFunc
//功能  ：封裝遠程注入的函數 
//參數 1：進程ID
//參數 2：被注入函數指針<函數名>  
//參數 3：參數  
//參數 4：參數長度
//**************************************************************************************
 
void InfusionFunc(DWORD dwProcId,LPVOID mFunc, LPVOID Param, DWORD ParamSize)
{ 
    HANDLE hProcess;//遠程句柄
    LPVOID mFuncAddr;//申請函數內存地址        
    LPVOID ParamAddr;//申請參數內存地址
    HANDLE hThread;    //線程句柄
    DWORD NumberOfByte; //輔助返回值  
    CString str;    
   //打開被注入的進程句柄     
    hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcId);
   //申請內存 
    mFuncAddr = VirtualAllocEx(hProcess,NULL,128,MEM_COMMIT,PAGE_EXECUTE_READWRITE); 
    ParamAddr = VirtualAllocEx(hProcess,NULL,ParamSize,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
   //寫內存 
   WriteProcessMemory(hProcess,mFuncAddr,mFunc,128, &NumberOfByte);   
   WriteProcessMemory(hProcess,ParamAddr,Param,ParamSize, &NumberOfByte); 
   //創建遠程線程 
    hThread = CreateRemoteThread(hProcess,NULL,0,(LPTHREAD_START_ROUTINE)mFuncAddr,
       ParamAddr,0,&NumberOfByte);
   WaitForSingleObject(hThread, INFINITE); //等待線程結束
   //釋放申請有內存 
   VirtualFreeEx(hProcess,mFuncAddr,128,MEM_RELEASE);
   VirtualFreeEx(hProcess,ParamAddr,ParamSize,MEM_RELEASE);     
   //釋放遠程句柄
   CloseHandle(hThread);
   CloseHandle(hProcess);
}

//**************************************************************************************
//函數名：CallAddhp
//功能  ：調用加血Call
//**************************************************************************************
 
void  CallAddhp ()
{ 
    DWORD dwAddr = 0x00452E98; 
   _asm 
   {        
       pushad 
       mov eax,dword ptr DS:[0x456D68]  
       mov edx,0x00453028 
       call dwAddr 
       popad 
    }
}   

//************************************************************************************** 
//函數名：CallAddhp
//功能  ：調用加法計算Call
//**************************************************************************************

void CallAdd(LPVOID lParam)
{
    ParamData * lp;
   lp=(ParamData *)lParam; 
    long lp1=(long)lp->Param1;
    long lp2=(long)lp->Param2;
    DWORD dwAddr = 0x45992C; 
   _asm
   { 
       pushad
       pushad 
       push lp2 
       push lp1
       mov eax,dword ptr DS:[0x461CF8] 
       push eax
       call dwAddr  
       popad 
   } 
}
下面是調用實例
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 
//一例:調用無參Call
void CInfusionFunDlg::OnButton4()
{
    // TODO: Add your control notification handler code here     
    DWORD ProcessId=NULL;
    HWND hWnd = ::FindWindow(NULL,"游戲找CALL練習實例one"); //窗口標題取句柄 
   GetWindowThreadProcessId(hWnd,&ProcessId); 
   if(ProcessId==NULL) 
       ::AfxMessageBox("未找到進程");   
 else 
   {

       InfusionFunc(ProcessId,CallAddhp,NULL,NULL); 
   } 
}
//二例:調用有參Call 
void CInfusionFunDlg::OnButtonAdd()  
{ 
    // TODO: Add your control notification handler code here
DWORD ProcessId=NULL; 
    HWND hWnd = ::FindWindow(NULL,"F8 CALL 01"); //窗口標題取句柄 
   GetWindowThreadProcessId(hWnd,&ProcessId); 
    ParamData CallParam; 
   CallParam.Param1 = atoi(m_edit1_text);
   CallParam.Param2 = atoi(m_edit2_text);
   if(ProcessId==NULL)
       ::AfxMessageBox("未找到進程");  
  else 
   { 
 
       InfusionFunc(ProcessId,CallAdd,&CallParam,sizeof(CallParam));
   }     
}